Security+ questions reward the best decision in context, not a statement that is merely true. A scenario may contain several technically correct options, but one will reduce risk fastest, respect the stated constraint and fit the scope of the incident.
Use the questions below as a decision drill. Read the scenario and choose an answer before opening the marked explanation. Pay particular attention to the constraint in each question: it is often the detail that separates the best answer from a plausible distractor.
1. Phishing and account compromise
This question tests whether you contain an active identity threat before investigating every possible cause. The user has already interacted with the message, so treat the account as potentially compromised.
MySummaries presents a Security+ question in this format:
A user reports entering their password into a page reached from an email claiming to be from the organisation's cloud provider. The user is still signed in on a company laptop. What is the BEST immediate action?
The best answer is to contain the identity threat first by disabling or restricting the account and revoking active sessions. This limits the value of a stolen password while the investigation continues. Blocking the sender does not address an already exposed credential, and malware scanning should not delay account containment. Changing the password alone may leave existing sessions or tokens active.
The useful sequence is not “collect evidence, then contain”. In an active credential-compromise scenario, containment comes first, followed by password reset, token or session revocation, log review and documentation.
2. Network segmentation
Here, the symptoms point to lateral movement, while the constraint is that the public-facing service must remain available. Choose the control that limits reach without unnecessarily taking the service offline.
A web server in a screened subnet has been compromised. The server must continue serving customers while the security team investigates. Which control BEST limits the attacker's ability to reach internal databases?
A default-deny boundary with only the required database flows permitted provides segmentation and reduces lateral movement. The web server and databases should not share an unrestricted trust zone. Disabling logs removes useful evidence, and administrative rights increase the impact of the compromise.
A strong Security+ answer maps the symptom—an exposed host—to the root risk—movement into a more trusted zone. Segmentation is more precise than simply saying “install a firewall”; the rule should reflect the required source, destination, port and direction.
3. Vulnerability prioritisation
Security teams rarely fix every finding at once. This question tests risk-based prioritisation rather than choosing the vulnerability with the most alarming label.
A vulnerability scanner reports four findings. Which should be remediated FIRST?
The internet-facing payment server combines high exploit impact, no authentication requirement and a valuable exposed asset. That combination creates the greatest immediate risk. Severity alone is not enough: asset value, exposure, exploitability and business impact determine priority. The other systems have substantially lower exposure or are no longer active.
When comparing vulnerabilities, state the factors aloud: exposure, exploitability, asset value, likelihood and impact. “Critical” is useful evidence, but the best answer connects the finding to the environment and the business consequence.
4. Least privilege
The next scenario distinguishes a temporary operational need from permanent administrative access.
A database administrator needs to run a schema migration during a planned change window. The administrator normally has read-only access. Which approach BEST follows least privilege?
A time-limited grant of only the privileges required for the approved migration is the least-privilege option. It should be recorded, monitored and removed when the change is complete. Permanent domain administration and password sharing create excessive, poorly attributable access. A temporary need does not justify an unmanaged device.
The words “approved”, “time-limited” and “minimum required” matter. Security+ scenarios often include an option that solves the task but violates access control, accountability or change-management constraints.
5. Hashing and encryption
This question tests precise terminology. Hashing provides a digest; encryption is reversible with the appropriate key.
An organisation needs to verify that a downloaded software package has not changed in transit. Which mechanism is MOST appropriate?
A cryptographic hash comparison detects changes to the package. The reference hash must come from a trusted channel; otherwise an attacker could replace both the package and the hash. Encryption protects confidentiality but does not by itself provide a public integrity comparison, while Base64 and compression do not provide security.
Do not use “encrypted” as a general synonym for protected. For confidentiality, think encryption. For integrity checking, think a cryptographic hash or a keyed integrity mechanism, depending on who must authenticate the data.
6. Recovery priorities
RTO and RPO describe different recovery objectives. This scenario asks for the control that addresses the acceptable amount of lost data.
A business states that, after a database outage, it can tolerate losing no more than five minutes of transactions. Which objective does this requirement define?
RPO defines the maximum acceptable amount of data loss measured in time, so a five-minute tolerance is an RPO. RTO is how quickly the service should be restored. MTTR measures repair time, while MTD is the maximum period the business can tolerate the service being unavailable.
A reliable shortcut is to ask: “Is this about data or time to restore service?” Data loss is RPO; restoration speed is RTO. A backup plan should be checked against both objectives rather than described simply as “regular backups”.
7. Incident response evidence
The best next step in an incident is affected by safety and evidence preservation. Do not destroy volatile information without a reason.
A workstation is suspected of running ransomware, but it is still connected to the corporate network. What should the analyst do FIRST?
Network isolation limits spread while preserving the system for authorised evidence collection. Wiping the device may destroy useful evidence and does not address other affected hosts. Continuing to use it increases risk, and deleting files without preserving evidence can undermine the investigation.
The practical order is contain, preserve, investigate, eradicate and recover, while following the organisation's incident process. The exact action may depend on authority and tooling, but “wipe first” is usually an unsafe answer when evidence and spread both matter.
8. Authentication federation
This question distinguishes authentication from authorisation and identifies the protocol commonly used for browser-based enterprise single sign-on.
An organisation wants employees to sign in to a cloud application using accounts managed by its central identity provider. The application must receive an assertion about the authenticated user. Which technology BEST fits this requirement?
SAML supports federated, browser-based single sign-on by allowing an identity provider to issue an assertion to a service provider. The other options provide detection, file monitoring or key protection; they do not perform the described identity federation. The assertion may include identity or group information, but the application still enforces its own authorisation decisions.
Keep the distinction clear: the identity provider authenticates the user, while the application decides what that user may do. A claim or assertion should not automatically mean unrestricted access.
9. Wireless security
This scenario tests whether you recognise the risk created by a rogue access point rather than treating every wireless problem as weak encryption.
Employees report connecting to an access point named “Company-Guest” that was not deployed by IT. Which control BEST helps identify and respond to this threat?
A wireless intrusion prevention system can monitor for rogue access points and support detection or containment. The network name does not prevent impersonation, and the other options do not address unauthorised wireless infrastructure. Investigation should still verify ownership before containment to avoid disrupting an authorised neighbouring network.
Notice the scope constraint in the final sentence. A technically powerful control can still be the wrong immediate action if it is applied without verification and could disrupt legitimate infrastructure.
10. Secure configuration
The final question combines secure defaults with a business requirement. Do not choose “disable the service” when the service is required; reduce its exposure and permissions instead.
A new application server requires HTTPS access from the internet, but its administration interface is currently reachable from any source address. What is the BEST immediate configuration change?
Restricting administration to a controlled management path applies least privilege and reduces attack surface while preserving the required public HTTPS service. Exposing administration globally increases risk. HTTP removes confidentiality and integrity protection, and broad administrator access creates unnecessary privilege.
For scenario questions, separate the required service from the unnecessary exposure. The best answer often preserves the business function but places management, authentication and monitoring behind stronger controls.
Review the decisions, not just the scores
After answering, classify each miss by the decision error:
- missed a constraint or scope detail;
- confused two precise terms, such as RTO and RPO;
- chose a true control but not the best next step;
- ignored least privilege, segmentation or secure defaults; or
- failed to prioritise containment and risk reduction.
A weak area is more useful when it is tied to a repeated error pattern. For example, “incident response” is broad; “I investigate before isolating an active endpoint” gives you a specific correction to practise.
Turn repeated misses into one-sentence remediation cards. The sentence should require a decision, not reproduce a paragraph from a textbook.
You lost this mark twice: an internet-facing host is compromised but must remain available. What is the best control to limit lateral movement?
For PBQs, use the same reasoning skeleton: identify the situation and constraints, name the likely threat, choose the highest-impact safe action, then state how you would validate, document and escalate it. That prepares you to apply the concepts rather than only recognise definitions.
How MySummaries helps
Build a Security+ board from your own notes, then generate scenario questions and use missed decisions to create a focused remediation queue. The platform can also mark written responses against the board's terminology and sequencing. Start at MySummaries.